An EKS Cluster's Kubelet should only allow explicitly authorized requests

eks
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

EKS worker node kubelets should resolve their effective authorization mode to Webhook so that kubelet API requests are explicitly authorized through the Kubernetes SubjectAccessReview API. An AlwaysAllow mode permits requests without webhook-based authorization and is noncompliant; a null or missing value indicates the live configz output should be re-verified.

Remediation

  1. Define authorization.mode: Webhook in the worker node bootstrap configuration (launch template user data or NodeConfig) so nodes join the cluster with the correct setting. See the EKS launch template documentation.
  2. For an existing node group, update the managed node group launch template version and roll or replace the nodes so EKS recycles each node from the corrected configuration, then re-audit the live kubelet configz output to confirm the effective value is Webhook. Avoid editing the kubelet config file directly on the host, as host-level edits can be overridden or lost when nodes are recycled.

References